2022 CVEs (page 152)
Page 152 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34486 | High | 7.2 | 2022-08-23 | Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to execute a malicious… |
CVE-2022-27637 | Medium | 6.1 | 2022-08-23 | Reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2022-25888 | High | 7.5 | 2022-08-23 | The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in… |
CVE-2022-25761 | High | 7.5 | 2022-08-23 | The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number… |
CVE-2022-25304 | High | 7.5 | 2022-08-23 | All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received… |
CVE-2022-25302 | High | 7.5 | 2022-08-23 | All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing handler for failed casting when unvalidated data is forward… |
CVE-2022-25231 | High | 7.5 | 2022-08-23 | The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, w… |
CVE-2022-24381 | High | 7.5 | 2022-08-23 | All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single se… |
CVE-2022-24298 | High | 7.5 | 2022-08-23 | All versions of package freeopcua/freeopcua are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sendin… |
CVE-2022-21208 | High | 7.5 | 2022-08-23 | The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single sessio… |
CVE-2022-2829 | Medium | 5.4 | 2022-08-23 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-35733 | Critical | 9.8 | 2022-08-23 | Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders (UDR-JA1004/JA1008/JA1016 firmware versions v1.0.20.13 a… |
CVE-2022-34919 | Critical | 9.8 | 2022-08-23 | The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated. By uploading a crafted aspx file… |
CVE-2022-33916 | High | 7.5 | 2022-08-23 | OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information. |
CVE-2022-35191 | Medium | 6.5 | 2022-08-23 | D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Service (DoS) via a craft… |
CVE-2022-2923 | Medium | 5.5 | 2022-08-22 | NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240. |
CVE-2022-38668 | High | 7.5 | 2022-08-22 | HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a s… |
CVE-2022-38667 | Critical | 9.8 | 2022-08-22 | HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser supports HT… |
CVE-2022-38171 | High | 7.8 | 2022-08-22 | Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially craft… |
CVE-2022-34652 | High | 8.8 | 2022-08-22 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can le… |
CVE-2022-33149 | High | 8.8 | 2022-08-22 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can le… |
CVE-2022-33148 | High | 8.8 | 2022-08-22 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can le… |
CVE-2022-33147 | High | 8.8 | 2022-08-22 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can le… |
CVE-2022-32778 | High | 7.5 | 2022-08-22 | An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass… |
CVE-2022-32777 | High | 7.5 | 2022-08-22 | An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass… |
CVE-2022-32772 | Medium | 6.1 | 2022-08-22 | A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT… |
CVE-2022-32771 | Medium | 6.1 | 2022-08-22 | A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT… |
CVE-2022-32770 | Medium | 6.1 | 2022-08-22 | A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT… |
CVE-2022-32769 | Medium | 5.0 | 2022-08-22 | Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-c… |
CVE-2022-32768 | Medium | 4.2 | 2022-08-22 | Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-c… |
CVE-2022-32761 | Medium | 6.5 | 2022-08-22 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-c… |
CVE-2022-32572 | High | 8.8 | 2022-08-22 | An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HT… |
CVE-2022-32282 | High | 8.8 | 2022-08-22 | An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash w… |
CVE-2022-30690 | Medium | 6.1 | 2022-08-22 | A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP re… |
CVE-2022-30605 | High | 8.8 | 2022-08-22 | A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP reques… |
CVE-2022-30547 | Critical | 9.9 | 2022-08-22 | A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP req… |
CVE-2022-30534 | High | 8.8 | 2022-08-22 | An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-craft… |
CVE-2022-2842 | High | 7.3 | 2022-08-22 | A vulnerability classified as critical has been found in SourceCodester Gym Management System. This affects an unknown part of the file login.php. The manipula… |
CVE-2022-29468 | High | 8.8 | 2022-08-22 | A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to incre… |
CVE-2022-28712 | Critical | 9.0 | 2022-08-22 | A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP… |
CVE-2022-28710 | Medium | 6.5 | 2022-08-22 | An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP requ… |
CVE-2022-26842 | Critical | 9.6 | 2022-08-22 | A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A spe… |
CVE-2022-26061 | High | 7.8 | 2022-08-22 | A heap-based buffer overflow vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execu… |
CVE-2022-25972 | High | 7.8 | 2022-08-22 | An out-of-bounds write vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution… |
CVE-2022-25942 | High | 7.8 | 2022-08-22 | An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. A… |
CVE-2022-1930 | Medium | 5.9 | 2022-08-22 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary inpu… |
CVE-2022-33932 | Medium | 5.3 | 2022-08-22 | Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an unprotected primary channel vulnerability. An un… |
CVE-2022-32480 | Medium | 4.3 | 2022-08-22 | Dell PowerScale OneFS, versions 9.0.0, up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an insecure default initialization of a resource v… |
CVE-2022-31238 | Medium | 4.7 | 2022-08-22 | Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain a process invoked with sensitive information vulner… |
CVE-2022-31237 | Low | 3.3 | 2022-08-22 | Dell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an improper preservation of permissions vulnerability in SyncIQ. A low p… |
CVE-2022-28598 | Medium | 6.1 | 2022-08-22 | Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in out… |
CVE-2022-35583 | Critical | 9.8 | 2022-08-22 | wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP… |
CVE-2022-35150 | Critical | 9.8 | 2022-08-22 | Baijicms v4 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2022-37134 | Critical | 9.8 | 2022-08-22 | D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi. When wantype is 3, l2tp_usrname will be decrypted by base64, and th… |
CVE-2022-37133 | High | 7.5 | 2022-08-22 | D-link DIR-816 A2_v1.10CNB04.img reboots the router without authentication via /goform/doReboot. No authentication is required, and reboot is executed when the… |
CVE-2022-36346 | Medium | 4.3 | 2022-08-22 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress. |
CVE-2022-35656 | Medium | 4.5 | 2022-08-22 | Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly. |
CVE-2022-35655 | Medium | 6.1 | 2022-08-22 | Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting. |
CVE-2022-35654 | Medium | 6.1 | 2022-08-22 | Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. |
CVE-2022-34858 | Critical | 9.8 | 2022-08-22 | Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress. |
CVE-2022-34857 | Medium | 6.1 | 2022-08-22 | Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPress |
CVE-2022-34776 | Medium | 5.5 | 2022-08-22 | Tabit - giftcard stealth. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a s… |
CVE-2022-34775 | Medium | 6.3 | 2022-08-22 | Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, a… |
CVE-2022-34774 | Medium | 6.3 | 2022-08-22 | Tabit - Arbitrary account modification. One of the endpoints mapped by the tiny URL, was a page where an adversary can modify personal details, such as email a… |
CVE-2022-34773 | Medium | 4.9 | 2022-08-22 | Tabit - HTTP Method manipulation. https://bridge.tabit.cloud/configuration/addresses-query - can be POST-ed to add addresses to the DB. This is an example of O… |
CVE-2022-34772 | Medium | 4.3 | 2022-08-22 | Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try loggin… |
CVE-2022-34771 | Medium | 5.5 | 2022-08-22 | Tabit - arbitrary SMS send on Tabits behalf. The resend OTP API of tabit allows an adversary to send messages on tabits behalf to anyone registered on the syst… |
CVE-2022-34770 | Medium | 4.6 | 2022-08-22 | Tabit - sensitive information disclosure. Several APIs on the web system display, without authorization, sensitive information such as health statements, previ… |
CVE-2022-34347 | Medium | 4.2 | 2022-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
CVE-2022-34149 | Critical | 9.8 | 2022-08-22 | Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. |
CVE-2022-33900 | Medium | 4.1 | 2022-08-22 | PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress. |
CVE-2022-2873 | Medium | 5.5 | 2022-08-22 | An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA… |
CVE-2022-2600 | Medium | 5.4 | 2022-08-22 | The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the ta… |
CVE-2022-2594 | High | 8.8 | 2022-08-22 | The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload fil… |
CVE-2022-2593 | High | 7.2 | 2022-08-22 | The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL query, which could allo… |
CVE-2022-2558 | Medium | 5.3 | 2022-08-22 | The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configur… |
CVE-2022-2557 | High | 8.8 | 2022-08-22 | The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path travers… |
CVE-2022-2555 | Medium | 6.5 | 2022-08-22 | The Yotpo Reviews for WooCommerce WordPress plugin through 2.0.4 lacks nonce check when updating its settings, which could allow attacker to make a logged in a… |
CVE-2022-2552 | Medium | 5.3 | 2022-08-22 | The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software… |
CVE-2022-2551 | High | 7.5 | 2022-08-22 | The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin… |
CVE-2022-2544 | High | 7.5 | 2022-08-22 | The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Dire… |
CVE-2022-2532 | Medium | 6.1 | 2022-08-22 | The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2022-2407 | Medium | 4.8 | 2022-08-22 | The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored… |
CVE-2022-2392 | Medium | 6.5 | 2022-08-22 | The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by users with "Contribut… |
CVE-2022-2389 | Medium | 4.3 | 2022-08-22 | The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not hav… |
CVE-2022-2388 | Medium | 6.5 | 2022-08-22 | The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a lo… |
CVE-2022-2383 | Medium | 6.1 | 2022-08-22 | The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2022-2382 | Medium | 4.3 | 2022-08-22 | The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authen… |
CVE-2022-2377 | Medium | 4.3 | 2022-08-22 | The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary… |
CVE-2022-2375 | Medium | 5.4 | 2022-08-22 | The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to upda… |
CVE-2022-2362 | High | 7.5 | 2022-08-22 | The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possibl… |
CVE-2022-2361 | Medium | 4.8 | 2022-08-22 | The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2022-2312 | Medium | 5.4 | 2022-08-22 | The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make logged in user with a… |
CVE-2022-2276 | Medium | 4.3 | 2022-08-22 | The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete ar… |
CVE-2022-2275 | Medium | 4.3 | 2022-08-22 | The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin delete arbitrary pos… |
CVE-2022-2198 | Medium | 4.3 | 2022-08-22 | The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messa… |
CVE-2022-2172 | Medium | 4.3 | 2022-08-22 | The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change settings via a CSRF a… |
CVE-2022-25812 | High | 7.2 | 2022-08-22 | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as… |
CVE-2022-25811 | High | 7.2 | 2022-08-22 | The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL sta… |
CVE-2022-25810 | Medium | 6.5 | 2022-08-22 | The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin… |